From: Greg Kroah-Hartman Date: Tue, 17 Jun 2014 23:40:33 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.95~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cc8e150f0fd1595a525ddfc70e53d3e696433ebd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch --- diff --git a/queue-3.10/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch b/queue-3.10/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch new file mode 100644 index 00000000000..64a0a533a88 --- /dev/null +++ b/queue-3.10/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch @@ -0,0 +1,47 @@ +From 1d2b60a5545942b1376cb48c1d55843d71e3a08f Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 5 Jun 2014 18:08:57 -0700 +Subject: iscsi-target: Reject mutual authentication with reflected CHAP_C + +From: Nicholas Bellinger + +commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream. + +This patch adds an explicit check in chap_server_compute_md5() to ensure +the CHAP_C value received from the initiator during mutual authentication +does not match the original CHAP_C provided by the target. + +This is in line with RFC-3720, section 8.2.1: + + Originators MUST NOT reuse the CHAP challenge sent by the Responder + for the other direction of a bidirectional authentication. + Responders MUST check for this condition and close the iSCSI TCP + connection if it occurs. + +Reported-by: Tejas Vaykole +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_auth.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -316,6 +316,16 @@ static int chap_server_compute_md5( + goto out; + } + /* ++ * During mutual authentication, the CHAP_C generated by the ++ * initiator must not match the original CHAP_C generated by ++ * the target. ++ */ ++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { ++ pr_err("initiator CHAP_C matches target CHAP_C, failing" ++ " login attempt\n"); ++ goto out; ++ } ++ /* + * Generate CHAP_N and CHAP_R for mutual authentication. + */ + tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); diff --git a/queue-3.10/series b/queue-3.10/series index 56fe527ace8..ee3f1c2bf4d 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -1 +1,2 @@ rtc-rtc-at91rm9200-fix-infinite-wait-for-ackupd-irq.patch +iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch